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Amendments to the Specification: 

Please replace Paragraph [0007] as filed with the following replacement 
paragraph: 

[0007] The present invention utilizes a search filter to solve the problems described 
5 above. "Search filter" is the method of searching words or documents proposed by 
Severance and Lohman in 1976. The principle of the method is that: selecting a Hash 
function, such as MD5 first; taking a value to be searched, such as "m", as the "key" 
of the Hash function, such as f(m) to perform a Hash Hush operation and obtain a 
proper data structure arrangement; and using the data structure to select the values to 
10 be checked. When a key is selected, it is not sure that if the key can be found fin e d in 
a search set according to the property of search filter, because the Hash space that the 
search filter uses is limited. On the other hand, when a key selected key does not 
belong to a search set, the search filter d e termin e s assures that the key does not belong 
to the search set. 

15 Please replace Paragraph [0018] as filed with the following replacement 
paragraph: 

[0018] (a) Suppos e Supposing that the firewall 20 in the Fig.l has N firewall rules 
{ 1 <i < N j ri }, wherein each rule consists of five items itmes : {source network rinets, 
20 destination network rinetd, source port riports, destination port riportd, protocol rip} . 
Each network described in the above rules includes the IP addresses that users want 
intend to filter and then remove. 

Please replace Paragraph [0024] as filed with the following replacement 
25 paragraph: 

[0024] Like the filtering procedure of the source network rinets described before, 
the filtering procedures of the destination network rinetd for the same firewall rule ri 
are to r e peat repeating the procedures S400 to S450 S250 : by first converting the 
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destination network rinetd into the binary code (including bit values and address), then 
setting W addresses bw (0 < bw < L-l, 0 < w< w-1) having bit value "1", 
destination port riportd and protocol rip as the keys of the hash function, and 
substituting introducing the keys into K specific hash functions hi (such as hi (bw, 
5 riportd, rip)) for hash calculation in order to get K*M values kj between 0 te and 

(C*K*L)-1. These kj include the relative addresses pointing to a hash space Hd in the 
destination network rinetd. The set of the relative addresses pointing to a hash space 
Hd can express the characteristic value of the source network rinets in the hash space 
Hd. Notice that each hash space uses the same C, K and L, so the size of the hash 
1 0 space Hd mentioned above equals the siz e that of the hash space Hs, and also equals 
sizes as well as each of other hash spaces. 

Please replace Paragraph [0031] as filed with the following replacement 
paragraph: 

15 

[003 1] Firstly in the procedure S500 S550 , the m e thod receiv e s a packet p to be 
checked is received . In the procedure S505, th e method e xtracts a source IP pips is 
extracted from the packet. In the procedure S510, the method conv e rts the source IP 
pips of the packet is converted into binary code. In the procedure S515 S505 , the- 

20 method s e arches a search for a set of M' relative addresses bm (0 < bm f < L- 1 ,0 1 
< m < M- 1 ) which have bit values " 1 " from the code of the source IP pips is_ 
conducted . In the procedure S520, the method sets each address having a bit value "1 ", 
source port pports and protocol pp^ pp are set as the keys of the hash function, and 
substitutes introduce the keys into K hash functions hi (such as hi (b"m, pports, pp)) 

25 for hash calculation in order to obtain K*M values kj between 0 to and (C*K*L)-1 . 
These kj include the relative addresses pointing to a hash space H's in the source IP 
pips. As fee described in the procedure S525, the setting of the relative addresses 
pointing to a hash space H's can present the characteristics of the source IP pips in the 
hash space H's. 
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